120 matches found
TrustJack
TrustJack Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows Blogpost: https://redteamer.tips/?p=108 To be used with a cmd that does whatever the F you want, for a dll that pops cmd, https://github.com/jfmaes/CMDLL. check the list in wietze's site to check how you...
DropSpawn_BOF
DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...
ShadowSteal
ShadowSteal | CVE-2021-36934 Implementación en Nim puro para explotar CVE-2021-36934, la escalada de privilegios local LPE SeriousSAM. No es seguro para OPSEC... todavía ;. No reclamo crédito por el descubrimiento de este exploit. Quick Start Compilar con Docker Empezar con ShadowSteal ahora es m...
CVE-2017-11783
CVE-2017-11783 Exploit de 1 día por sheisback No es un exploit completo ejecuta cmd con privilegios de sistema, solo crea un archivo en system32. Así que tendrás que completarlo; necesitas la técnica de UAC de consent.exe. Referencia Una mirada a ALPC-RPC por Clément Rouault & Thomas Imbert, 2017...
CVE-2024-31771
CVE-2024-31771 TotalAV 任意文件写入 TotalAV 版本 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 时间线： 2024年2月13日：发现 6.0.740 存在漏洞并向 TotalAV 报告。 2024年2月15日：TotalAV 确认并复现了该问题。 2024年2月19日：TotalAV 正在与另一家供应商协调，该供应商表示正在处理。 2024年3月18日 - 4月19日：请求更新，未收到 TotalAV...
HardBreacher
HardBreacher Vulnerabilidad de Elevación de Privilegios ZeroDay en Kaspersky Antivirus para Endpoint El problema ahora está saliendo del ámbito de Microsoft; se realizó una votación para decidir entre encontrar un fallo en la versión doméstica o en la comercial, y el resultado de la votación fue ...
CS-DropSpawn_BOF
DropSpawn Introducción DropSpawn es un BOF de CobaltStrike utilizado para lanzar Beacons adicionales mediante un método relativamente desconocido de secuestro de DLL. Funciona en x86-x86, x64-x64 y x86-x64/viceversa. Úsalo como alternativa a la inyección de procesos. Los ejecutables de Windows...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 Corrección de PowerShell Este script de PowerShell corrige CVE-2021-36934, basado en el script original de Joran Slingerland https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 El script de PowerShell ha...
CVE-2020-1337
CVE-2020-1337 - 二进制植入（CVE-2020-1048 绕过） SafeBreach 的 Peleg Hadar @peleghd 和 Tomer Bar 因 CVE-2020-1048 而受到 Microsoft 致谢，该漏洞是 Windows 打印后台处理程序漏洞，可在 Windows 7 及更高版本上实现权限提升。 Alex Ionescu @aionescu 和 Yarden Shafir @yardenshafir 在其精彩的博客文章 PrintDemon: Print Spooler Privilege Escalation, Persistence &...
CVE-2026-13133
A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...
EUVD-2026-55033
A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...
CVE-2026-13133
LineInst.exe (LINE for Windows) before version 26.4.0 is vulnerable because Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer directory to be loaded ahead of the legitimate System32 copy. The CVSS metrics indicate a HIGH ...
CVE-2019-18194
TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder...
CVE-2023-53937
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937
Hubstaff 1.6.14 is affected by a DLL search order hijacking vulnerability that enables replacing the missing system32 wow64log.dll with a malicious library. An attacker could generate a custom DLL (e.g., via Metasploit) and place it in the system32 directory to obtain a reverse shell when the app...
CVE-2023-53937 Hubstaff 1.6.14 DLL Search Order Hijacking via wow64log Library
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
PT-2025-52316
Name of the Vulnerable Software and Affected Versions Hubstaff version 1.6.14 Description The software contains a DLL search order hijacking issue. An attacker can replace a missing system32wow64log.dll with a malicious library. By using tools like Metasploit to create a custom DLL and placing it...